- Shipped
- October 18, 2026 at 5:46 AM UTC
- Author
- Kamo
- Commit
- 49339a2
POST **************** IoTService posts the IOT_SHARE card into a members' support ticket or Exec2Exec conversation as the sharer's system event, through the one system-event writer (now also answering the stored message id). X-Internal-Auth = IOT_INTERNAL_AUTH_SECRET (Secret iot-internal-auth, already mounted for SP01's STOMP authz), constant-time; 503 blank, 403 mismatch. A Live Support (visitor) ticket is refused 409 SESSION_TYPE; a card may not carry a key the writer owns. Every client write path now refuses text that parses as a system event with 400 SYSTEM_EVENT_RESERVED: member send, message edit (into or out of a system event), Exec2Exec post, website visitor send, bug-report comment, and forwarding (a system event is not forwardable; a forged comment is refused). A consent card must not be forgeable by a participant.